Report - 65349483af14…3d238820b8

Suspicious HighFILE

Quota 38

First seen: 2023-03-25T09:18:41Z
Last seen: 2026-05-15T20:49:37Z

THREAT SIGNALLow Read alongside the verdict

CONFIDENCENot providedVirusSign analysis

FAMILYvundoMalware classification

RELATED INDICATORS12Connections in this report

ANALYSISSuspiciousHistorical

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: 65349483af14f9cd7eb2152aaf8713bbb258fc029e5f17ecdfcdbd3d238820b8
SHA1: e43fcba9885c1825b47075ccbac88151a983c4f8
MD5: 87ee380bb5da2f74904ac021d84597c9
Filename: 65349483_87ee380bb5da2f74904ac021d84597c9.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 122096
Compile time: 2023-03-01T09:41:03Z
PE platform: x86 32-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Threat context

Classification includes family vundo.

Analysis signals

OBSERVED

Engine detections4%

Relationship context12 visible

Threat classificationvundo

Intelligence freshnessHistorical

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

12 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

33840fdd3b457922f8c0fb3be13436319f8c86aa0bdd11bb817f55d541ad4f22

6% high zip 425566931 bytes contains

Filename 33840fdd_acc80cwp.zip.bin Family vundo File type zip MIME application/zip Size 425566931

20ac8f91ca8bfbdc764eef56b3a2d113fc696b079f13307c997d8a703a01f0d3

0% zip 313577780 bytes drops

Filename 20ac8f91_acc74cwp.zip.bin File type zip MIME application/zip Size 313577780 SHA1 93ed2e4e96a9e6b73e3cde602ce6aa46228b04b0

453e137fdb28b698fe2862f1853f22923b64199e634e7a4622ed06f4a1cc7e55

0% zip 574796850 bytes drops

Filename 453e137f_acc80cwp.zip.bin Type malware File type zip MIME application/zip Size 574796850

a790fb4beac63779be1f988376fe736a56b291bdc3554201b6af543c63137907

6% medium zip 425146749 bytes drops

Filename a790fb4b_acc80cwp.zip.bin Type pua File type zip MIME application/zip Size 425146749

533f3d51caf21ae4ebc672527d917f2d81c0faba862a7a736df3b19fd41b78e4

6% medium zip 425004606 bytes drops

Filename 533f3d51_acc80cwp.zip.bin Type pua File type zip MIME application/zip Size 425004606

Dropped / child files

Files dropped, bundled, or created by the queried file.

1shown

59ba97d56a01766792386c3b379946bb613c8921e3daf8a878855a268ad5e4aa

0% xml 548 bytes contains

Filename 59ba97d5_2_1.bin File type xml MIME application/xml Size 548 SHA1 c0a369f6f0e77b89c5d9d37fb94e1d5e2d431b5b

Related IPs

Network IPs associated with this indicator.

4shown

23.216.147.76

0% US communicates

CIDR 23.216.144.0/21 Network 23.192.0.0-23.223.255.255 First seen 2023-09-30T05:49:19Z Last seen 2026-11-15T07:54:23Z

20.99.185.48

0% US communicates

CIDR 20.64.0.0/10 Network 20.33.0.0-20.128.255.255 First seen 2023-09-29T22:00:59Z Last seen 2026-11-15T06:15:47Z

20.99.184.37

0% US communicates

CIDR 20.64.0.0/10 Network 20.33.0.0-20.128.255.255 First seen 2023-09-29T18:30:08Z Last seen 2026-11-15T05:32:10Z

192.229.211.108

0% US communicates

Network 192.229.128.0-192.229.255.255 First seen 2023-09-28T19:16:46Z Last seen 2026-11-15T08:00:35Z

Related domains

Domains associated with this indicator.

2shown

secure.identrust.com

0% .com communicates

Root identrust.com TLD com Subdomain secure First seen 2025-02-03T22:47:57Z Last seen 2026-05-13T11:09:54Z

validation.identrust.com

0% .com communicates

Root identrust.com TLD com Subdomain validation First seen 2023-09-29T19:56:23Z Last seen 2026-11-10T15:01:57Z

Analysis details

Severity: highinput-checkfile-overlaydebug-checkdynamic-loadingcpu-clockexesigned

Freshness: Historical · Last seen 183 days ago.

Detection rate: 4%
Family: vundo
detection: 4 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 65349483af14f9cd7eb2152aaf8713bbb258fc029e5f17ecdfcdbd3d238820b8
SHA1: e43fcba9885c1825b47075ccbac88151a983c4f8
MD5: 87ee380bb5da2f74904ac021d84597c9
Filename: 65349483_87ee380bb5da2f74904ac021d84597c9.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 122096
Compile time: 2023-03-01T09:41:03Z
PE platform: x86 32-bit
PE sections: 6
Import libraries: 3
TLSH: T1B0C36B01B5E2D972F5B31A3128799A71593DFC251B20CE7F27E8026E1E342C09976EB7
SSDEEP: 3072:Os6S95y5lBvXrv9mzwb7Ag0FuDl6K1r8JC:76S9IhAO9p8k
Imphash: 38a7b33b1323bba8ae4c382a194834f7
Richhash: 3b2c7b059ce3ea27720038eb3d844aa8
First seen: 2023-03-25T09:18:41Z
Last seen: 2026-05-15T20:49:37Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Threat context

Classification includes family vundo.

Relationship context

12 related indicators are shown across 4 relationship group(s).

Observation timeline

13 timestamped observations are arranged from 2015-08-31 to 2025-10-24. These are observation or metadata times, not execution order.

Infrastructure geography

4 infrastructure/location point(s) are visible on the map.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 4%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

Relationship context 12 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification vundo

Classification context: family vundo.

Intelligence freshness Historical

Last seen 183 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 65349483_87ee380bb5da2f74904ac021d84597c9.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 122096
Compile time: 2023-03-01T09:41:03Z
PE platform: x86 32-bit
Entry point: 7127
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

input-checkdebug-checkcpu-clockdynamic-loading

View details · 5 shown

Binary contains paths to debug symbols
Classification label
Contains modern PE file flags such as dynamic base (ASLR) or NX
Creates a DirectInput object (often for capturing keystrokes)
PE / OLE file has a valid certificate

5 shown

View MITRE ATT&CK details · 5 shown

T1056 — Creates a DirectInput object (often for capturing keystrokes)
Tactics: TA0006 · TA0009
T1082 — Reads software policies
Tactics: TA0007
T1083 — get common file path
Tactics: TA0007
T1129 — link function at runtime on Windows
Tactics: TA0002
T1134 — modify access privileges
Tactics: TA0004 · TA0005

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5

TCP, UDPports 443, 53, 80

5 outbound connections observed
0 domains, 5 IPs, 0 URLs
Common ports: 443, 53, 80
Protocols: TCP, UDP

View details · 5 shown

IP: a83f:8110:0:0:0:0:2002:0
Port: 53
Protocol: UDP

IP: 23.216.147.76
Port: 443
Protocol: TCP

IP: 20.99.185.48
Port: 443
Protocol: TCP

IP: 20.99.184.37
Port: 443
Protocol: TCP

IP: 192.229.211.108
Port: 80
Protocol: TCP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 2023-03-01T09:41:03Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 7127
Sections: 6
Compile time: 2023-03-01T09:41:03Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 54997
Raw size: 55296
Permissions: rx
Entropy: 6.66

Name: .rdata
Virtual address: 61440
Virtual size: 43948
Raw size: 44032
Permissions: r
Entropy: 5.63

Name: .data
Virtual address: 106496
Virtual size: 5936
Raw size: 2560
Permissions: rw
Entropy: 2.22

Name: .gfids
Virtual address: 114688
Virtual size: 244
Raw size: 512
Permissions: r
Entropy: 1.83

Name: .rsrc
Virtual address: 118784
Virtual size: 2632
Raw size: 3072
Permissions: r
Entropy: 3.57

5 shown

Imports3

3 DLL groups

3 import DLL groups
5+ imported functions summarized

View details · 3 shown

Library: ADVAPI32.dll
Functions: AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken

Library: USER32.dll
Functions: ExitWindowsEx, LoadStringW, MessageBoxW, wsprintfW

Library: KERNEL32.dll
Functions: CloseHandle, CompareStringW, CreateFileW, CreateProcessW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection …

Resources3

3 resources

3 resources
Resource types: RT_MANIFEST, RT_STRING, RT_VERSION

View details · 3 shown

Type: RT_STRING
Language: ENGLISH US

Type: RT_VERSION
Language: NEUTRAL

Type: RT_MANIFEST
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

4 issuers

Example subject: HID GLOBAL CORPORATION
Issued by: TrustID EV Code Signing CA 4
Validity period (UTC): 2022-11-04 – 2025-11-03

View details · 5 shown

Subject: HID GLOBAL CORPORATION
Issuer: TrustID EV Code Signing CA 4
Valid from: 1667558220.0
Valid to: 1762166160.0
Fingerprint: 08642A90AF8C3D53680CD6D1D9884F16C0368FB6

Subject: TrustID EV Code Signing CA 4
Issuer: IdenTrust Commercial Root CA 1
Valid from: 1647623340.0
Valid to: 1900084140.0
Fingerprint: 3A3B4FCAF1971D1ED4ADD7A2A3A0794DC62C64BC

Subject: IdenTrust Commercial Root CA 1
Issuer: IdenTrust Commercial Root CA 1
Valid from: 1389895920.0
Valid to: 2021047920.0
Fingerprint: DF717EAA4AD94EC9558499602D48DE5FBCF03A25

Subject: Sectigo RSA Time Stamping Signer #3
Issuer: Sectigo RSA Time Stamping CA
Fingerprint: AB34013AAC4097319F081AF0B318E183F80F7881

Subject: Sectigo RSA Time Stamping CA
Issuer: USERTrust RSA Certification Authority
Fingerprint: 02D65B95E28370C1570095FA88F923DD937FAD8F

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check